An enterprise security operations team is enhancing the security posture of an automated CI/CD deployment pipeline for containerized microservices. To prevent configuration drift from the established hardening baseline and guarantee timely vulnerability remediation across deployed container hosts, which of the following operational practices should be implemented? (Select TWO.)
- Rebuild and redeploy container base images whenever security patches are published for underlying OS dependenciesAnswer
- BDeploy network firewall rules to block traffic targeting unpatched software vulnerabilities as a permanent replacement for patching
- Integrate automated configuration baseline scanning into the build pipeline to reject non-compliant image definitionsAnswer
- DReclassify unauthorized configuration drift as a detective control to allow non-compliant images to bypass build checks
Answer
Rebuilding and redeploying container base images when OS patches are released, along with integrating automated baseline compliance scanning into the deployment pipeline, ensures effective patch and configuration management.
In modern containerized deployments, patch management relies on updating the underlying base image and redeploying containers (immutable infrastructure) rather than patching live instances. Simultaneously, automated baseline scanning during the pipeline execution ensures that configuration standards are verified before deployment, effectively preventing configuration drift.
Step-by-Step Solution
Key Concept
Immutable Container Patching and Pipeline Configuration Auditing